How to Check C2PA Content Credentials

Quick answer: Open a C2PA-compatible viewer, inspect the original image or video when possible, and read the credential status with its signature and provenance details. Verification checks the available credential and its applicable bindings. It does not automatically prove that every claim is true.

Step 1 — Start with the original file

Whenever possible, start with the original file or the earliest provenance-bearing export. Screenshots, messaging-app copies, and re-shared media can change the file or separate it from the evidence that was available in the original export.

C2PA credentials can be embedded in an asset or associated through sidecar or remote manifests. This guide covers the practical first check: supplying the file you have to a viewer. If the original export is not available, you can still inspect the copy, but less evidence may remain.

A screenshot normally creates a new image and does not carry the original file's C2PA Content Credential. Inspecting the screenshot tells you about the screenshot, not about the complete provenance of the original capture.

Step 2 — Open C2PA Lab

Open the C2PA Lab viewer in a modern browser. The inspection runs entirely on your device. No file upload is required.

The viewer supports common image and video formats. If you do not have a C2PA file available, the viewer also includes prepared C2PA samples and a no-credential example.

Step 3 — Drop the file

Drag the file into the upload area, choose a file, or paste it if your browser supports that action. The viewer reports the five result states below.

The five result states

1. Verified
2. Verification failed
3. Verification unavailable
4. No Content Credentials found
5. Unable to inspect this file

None of these states is an authenticity score. They describe what the viewer found and what it could validate under its current checks and configuration.

Step 4 — Understand the result

After the status, check the signature context. A signature can be cryptographically verified while the signer is not recognized by the viewer's trust configuration. See How C2PA verification works for the difference between cryptographic validation and trust.

Step 5 — Inspect provenance and technical details

When actions are recorded, they appear in the provenance timeline exactly as the manifest states them. If no actions are recorded, the viewer should not invent a creation or editing history.

Expand the technical details to inspect assertions, ingredients, signer information, validation results, and the raw manifest JSON. Treat these as evidence to read, not as a single truth score.

Why starting with the original file matters

Original capture
      |
C2PA credential
      |
Editing / export
      |
Social platform or messaging app
      |
Re-encoded copy
      |
Credentials may be unavailable

Each step can preserve provenance, record it in a new manifest, or make it harder to discover. Platforms may re-compress media or remove embedded containers during processing. X, Instagram, WhatsApp, and WeChat are common examples of services where this can happen, but behavior varies by platform, format, account type, and workflow.

This is why a re-shared copy may no longer contain readable Content Credentials, especially if the platform re-encoded the asset. The absence of evidence in that copy is not proof that the original never had evidence.

A concrete example

For a credentialed JPEG, the viewer may show a verified manifest, the generating application, recorded actions, ingredient references, signature information, and the raw manifest JSON. A re-shared copy of the same image may show No Content Credentials found; that result means no readable credential was found in the inspected asset, not that the viewer has assigned a suspicion score.

If you want to see the workflow without your own file, open the homepage example gallery. It includes verified C2PA samples, a composed asset with ingredients, and an official example with no C2PA manifest store.

What C2PA verification does not prove

A verified result does not prove that every claim in the credential is factually true, that the scene happened as described, or that every edit was recorded. It also does not prove that a signer is trustworthy under every possible trust policy.

A missing result does not make the opposite claim either. No Content Credentials found does not mean the file is fake, edited, or AI-generated.

Check a real file

Open C2PA Lab and inspect a file directly in your browser. No file upload is required. To explore signed manifest structure in more depth, use the C2PA Manifest Viewer.

Interactive Tool

Check a file on C2PA Lab

Run the inspection directly in your browser. Your file stays on your device, no file upload is required, and the viewer separates validation status from declared provenance.

Check a file

Official references

C2PA terms, manifest discovery, and validation behavior are defined by the official C2PA specifications.

FAQ

Does C2PA prove an image is authentic?

No. Verification shows that the applicable credential and bindings passed the viewer's checks. It does not establish that every claim is factually true.

Does no Content Credentials mean an image is AI-generated?

No. It only means that no readable C2PA Content Credential was found in the inspected asset.

Can a screenshot keep C2PA credentials?

Normally, no. A screenshot creates a new image asset and does not carry the original file's credential.

Why did my file lose Content Credentials?

Re-encoding, editing, export workflows, unsupported handling, or platform processing can make credentials unavailable in the resulting file. Some workflows can preserve or recreate provenance, so it is useful to inspect the earliest file you can obtain.

Do I need an account?

No. Open the viewer, choose a file or example, and inspect it locally in your browser.

Related guides

Background: What is C2PA?, What are Content Credentials?, and How C2PA verification works.